Toward a Decision Support System for Measuring and Managing Cybersecurity Risk in Supply Chains

Much of the confusion about the effectiveness of information security programs concerns not only how to measure, but also what to measure — an issue of equivocality. Thus, to lower uncertainty for improved decision-making, it is first essential to reduce equivocality by defining, expanding, and clarifying risk factors so that metrics, the "necessary measures," can be unambiguously applied. We formulate a system that (1) allows threats to be accurately measured and tracked, (2) enables the impacts and costs of successful threats to be determined, and (3) aids in evaluating the effectiveness and return on investment of countermeasures. We then examine the quality of controls implemented to mitigate cyber risk and study how effectively they reduce the likelihood of security incidents. Improved control quality was shown to reduce the likelihood of security incidents, yet the results indicate that investing in maximum quality is not necessarily the most efficient use of resources. The next manuscript expands the discussion of cyber risk management beyond single organizations by surveying perceptions and experiences of risk factors related to 3rd parties. To validate and these findings, we undertake in an in-depth investigation of nearly 1000 real-world data breaches occurring over a ten-year period. It provides a robust data model and rich database required by a decision support system for cyber risk in the extended enterprise. To our knowledge, it is the most comprehensive field study ever conducted on the subject. Finally, we incorporate these insights, data, and factors into a simulation model that enables us study the transfer of cyber risk across different supply chain configurations and draw important managerial implications.

Name thesis:degree_name

Ph. D.

Level thesis:degree_level

doctoral

Discipline thesis:degree_discipline

Business, Business Information Technology

Department dc:contributor.department

Business Information Technology

Grantor dc:publisher

Virginia Tech

Year dc:date.issued

2017

Author dc:creator

• Baker, Wade Henderson

Chair dc:contributor.committeechair

• Rees, Loren P.

Committee members dc:contributor.committeemember

• Cook, Deborah F.
• Matheson, Lance A.
• Wallace, Linda G.
• Ragsdale, Cliff T.

• cybersecurity
• cyber security
• information security
• cyber risk
• information risk
• risk modeling
• risk management
• security metrics
• decision support systems
• supply chain management
• supply chain risk
• supply chain information sharing

Statement dc:rights

• In Copyright

Licence dc:rights.uri

• http://rightsstatements.org/vocab/InC/1.0/

Dc Identifier Other

vt_gsexam:9779

OAI identifier oai:identifier

oai:vtechworks.lib.vt.edu:10919/85128